CVE-2023-48635 - ZDI-CAN-22174: Adobe After Effects AEP File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability · CoreCVE

Back Back to CVE browser

MEDIUM

ZDI-CAN-22174: Adobe After Effects AEP File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

Published Dec 13, 2023

5.5

MEDIUM

CVSS 3.1

EPSS 0.38%

Description

Adobe After Effects versions 24.0.3 (and earlier) and 23.6.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Affected products

Vendor Adobe Product After Effects Default
affected
- Version
  0
  Status
  affected
  Constraints
  <=23.6.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

affected

Version	Status	Constraints
0	affected	<=23.6.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-125

Out-of-bounds Read

References (1)

https://helpx.adobe.com/security/products/after_effects/apsb23-75.html
vendor-advisoryPatchVendor Advisory

Link	Providers	Tags
https://helpx.adobe.com/security/products/after_effects/apsb23-75.html		vendor-advisoryPatchVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner adobe

Published Dec 13, 2023

Updated Sep 11, 2024

Reserved Nov 16, 2023

Link CVE-2023-48635

CISA Vulnrichment

Updated Feb 6, 2024

Status Modified

Modified Jun 17, 2026

Link CVE-2023-48635

Severity n/a

Public date n/a

Links CVE-2023-48635